[Fire TV Q&A, Help & Troubleshooting] BagiMT:
That is interesting. I removed the system app (priv-app) and installed 5.10 as a regular app. I have rebooted several times now and it has not updated to a different version. 6.0.2 works for me but it shows even fewer app categories than 5.10.31. There is some issue with the leanback play store not loading all the app recommendations (widgets) but I have not figured out what it is. I also get consistent crashes when opening some of the app categories (e.g. Music). Here are some error logs if anybody has suggestions. The last part is the crash.

D/Finsky ( 6948): [1] RestoreTracker.stopServiceIfDone: Restore complete with 0 success and 0 failed.
I/art ( 6991): Background sticky concurrent mark sweep GC freed 8051(421KB) AllocSpace objects, 3(60KB) LOS objects, 0% free, 3MB/3MB, paused 34.249ms total 69.225ms
D/Finsky ( 6948): [1] BaseWidgetProvider.onReceive: Received ACTION_APPWIDGET_UPDATE, updating 0 widgets.
W/Settings( 6948): Setting install_non_market_apps has moved from android.provider.Settings.Global to android.provider.Settings.Secure, returning read-only value.
W/Settings( 6948): Setting download_manager_max_bytes_over_mobile has moved from android.provider.Settings.Secure to android.provider.Settings.Global.
D/Finsky ( 6948): [1] GaiaRecoveryHelper.prefetchAndCacheGaiaAuthRecoveryIntent: Skipping fetching recovery intent -- gaia recovery disabled
D/Finsky ( 6948): [1] BaseWidgetProvider.onReceive: Received ACTION_APPWIDGET_UPDATE, updating 0 widgets.
W/art ( 6991): Suspending all threads took: 68.223ms
I/art ( 6991): Background partial concurrent mark sweep GC freed 356(30KB) AllocSpace objects, 0(0B) LOS objects, 39% free, 4MB/7MB, paused 69.161ms total 101.402ms
D/Finsky ( 6948): [1] LeanbackBrowseFragment.onActivityCreated: Play Store version [80403186]/[5.10.31-leanback]
E/Finsky ( 6948): [1] DfeRequest.<init>: Empty DFE URL
E/Finsky ( 6948): java.lang.Exception
E/Finsky ( 6948):	at com.google.android.finsky.utils.FinskyLog.wtf(FinskyLog.java:43)
E/Finsky ( 6948):	at com.google.android.finsky.api.DfeRequest.<init>(DfeRequest.java:163)
E/Finsky ( 6948):	at com.google.android.finsky.api.DfeRequest.<init>(DfeRequest.java:146)
E/Finsky ( 6948):	at com.google.android.finsky.api.DfeApiImpl.getBrowseLayout(DfeApiImpl.java:314)
E/Finsky ( 6948):	at com.google.android.finsky.api.model.DfeBrowse.<init>(DfeBrowse.java:44)
E/Finsky ( 6948):	at com.google.android.finsky.api.model.DfeBrowse.<init>(DfeBrowse.java:33)
E/Finsky ( 6948):	at com.google.android.finsky.fragments.LeanbackBrowseFragment.refresh(LeanbackBrowseFragment.java:14417)
E/Finsky ( 6948):	at com.google.android.finsky.fragments.LeanbackBrowseFragment.onActivityCreated(LeanbackBrowseFragment.java:413)
E/Finsky ( 6948):	at android.support.v4.app.FragmentManagerImpl.moveToState(FragmentManager.java:7973)
E/Finsky ( 6948):	at android.support.v4.app.FragmentManagerImpl.moveToState(FragmentManager.java:1259)
E/Finsky ( 6948):	at android.support.v4.app.BackStackRecord.run(BackStackRecord.java:738)
E/Finsky ( 6948):	at android.support.v4.app.FragmentManagerImpl.execPendingActions(FragmentManager.java:1624)
E/Finsky ( 6948):	at android.support.v4.app.FragmentManagerImpl$1.run(FragmentManager.java:517)
E/Finsky ( 6948):	at android.os.Handler.handleCallback(Handler.java:739)
E/Finsky ( 6948):	at android.os.Handler.dispatchMessage(Handler.java:95)
E/Finsky ( 6948):	at android.os.Looper.loop(Looper.java:135)
E/Finsky ( 6948):	at android.app.ActivityThread.main(ActivityThread.java:5462)
E/Finsky ( 6948):	at java.lang.reflect.Method.invoke(Native Method)
E/Finsky ( 6948):	at java.lang.reflect.Method.invoke(Method.java:372)
E/Finsky ( 6948):	at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:964)
E/Finsky ( 6948):	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:759)
E/Finsky ( 6948):	at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:117)
F/Finsky ( 6948): [1] DfeRequest.<init>: Empty DFE URL
I/ActivityManager( 525): addErrorToDropBox inserted hashcode=6ce44d3cd297542b4ed3cd40465d4bf916902545 for eventType wtf.
D/Finsky ( 6948): [1] BaseWidgetProvider.onReceive: Received ACTION_APPWIDGET_UPDATE, updating 0 widgets.
I/CrashDescriptorUtil( 525): addErrorToCommonLog Hash already present in file
I/art ( 6948): Background partial concurrent mark sweep GC freed 2389(169KB) AllocSpace objects, 0(0B) LOS objects, 40% free, 5MB/9MB, paused 10.135ms total 41.174ms
E/Finsky ( 6948): [1] DfeRequest.<init>: Empty DFE URL
E/Finsky ( 6948): java.lang.Exception
E/Finsky ( 6948):	at com.google.android.finsky.utils.FinskyLog.wtf(FinskyLog.java:43)
E/Finsky ( 6948):	at com.google.android.finsky.api.DfeRequest.<init>(DfeRequest.java:163)
E/Finsky ( 6948):	at com.google.android.finsky.api.DfeRequest.<init>(DfeRequest.java:146)
E/Finsky ( 6948):	at com.google.android.finsky.api.DfeApiImpl.getBrowseLayout(DfeApiImpl.java:314)
E/Finsky ( 6948):	at com.google.android.finsky.api.model.DfeBrowse.<init>(DfeBrowse.java:44)
E/Finsky ( 6948):	at com.google.android.finsky.api.model.DfeBrowse.<init>(DfeBrowse.java:33)
E/Finsky ( 6948):	at com.google.android.finsky.fragments.LeanbackBrowseFragment.refresh(LeanbackBrowseFragment.java:14417)
E/Finsky ( 6948):	at com.google.android.finsky.fragments.LeanbackBrowseFragment.onCreateBrowseRowsFragment(LeanbackBrowseFragment.java:903)
E/Finsky ( 6948):	at com.google.android.finsky.activities.TvMainActivity.onCreateBrowseRowsFragment(TvMainActivity.java:973)
E/Finsky ( 6948):	at com.google.android.finsky.widget.BrowseRowsFragment.onActivityCreated(BrowseRowsFragment.java:1079)
E/Finsky ( 6948):	at android.app.Fragment.performActivityCreated(Fragment.java:2061)
E/Finsky ( 6948):	at android.app.FragmentManagerImpl.moveToState(FragmentManager.java:912)
E/Finsky ( 6948):	at android.app.FragmentManagerImpl.moveToState(FragmentManager.java:1067)
E/Finsky ( 6948):	at android.app.BackStackRecord.run(BackStackRecord.java:834)
E/Finsky ( 6948):	at android.app.FragmentManagerImpl.execPendingActions(FragmentManager.java:1452)
E/Finsky ( 6948):	at android.app.FragmentManagerImpl$1.run(FragmentManager.java:447)
E/Finsky ( 6948):	at android.os.Handler.handleCallback(Handler.java:739)
E/Finsky ( 6948):	at android.os.Handler.dispatchMessage(Handler.java:95)
E/Finsky ( 6948):	at android.os.Looper.loop(Looper.java:135)
E/Finsky ( 6948):	at android.app.ActivityThread.main(ActivityThread.java:5462)
E/Finsky ( 6948):	at java.lang.reflect.Method.invoke(Native Method)
E/Finsky ( 6948):	at java.lang.reflect.Method.invoke(Method.java:372)
E/Finsky ( 6948):	at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:964)
E/Finsky ( 6948):	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:759)
E/Finsky ( 6948):	at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:117)
F/Finsky ( 6948): [1] DfeRequest.<init>: Empty DFE URL
I/ActivityManager( 525): addErrorToDropBox inserted hashcode=15384d6efea7140e81cc25debfdf283e11605f68 for eventType wtf.
I/CrashDescriptorUtil( 525): addErrorToCommonLog Hash already present in file
V/JNIHelp ( 6991): Registering com/google/android/gms/org/conscrypt/NativeCrypto's 254 native methods...
I/ProviderInstaller( 6991): Installed default security provider GmsCore_OpenSSL
D/NativeLibraryUtils( 6991): Install completed successfully. count=0 extracted=0
D/WearableService( 2017): callingUid 32081, callindPid: 2017
E/MDM ( 2017): [159] b.run: Couldn't connect to Google API client: ConnectionResult{statusCode=API_UNAVAILABLE, resolution=null, message=null}
D/LocationInitializer( 6991): Restart initialization of location
D/AuthorizationBluetoothService( 2017): Received GmsCore event: Intent { act=com.google.android.gms.INITIALIZE flg=0x10 pkg=com.google.android.gms cmp=com.google.android.gms/.auth.be.proximity.authorization.bt.AuthorizationBluetoothService$AutoStarter }.
V/GLSActivity( 2017): AuthDelegateWrapperCreated with selected intent: Intent { cmp=com.google.android.gms/.auth.DefaultAuthDelegateService }

I/qtaguid ( 6948): Failed write_ctrl(u 69) res=-1 errno=22
I/qtaguid ( 6948): Untagging socket 69 failed errno=-22
W/NetworkManagementSocketTagger( 6948): untagSocket(69) failed with errno -22
E/Volley ( 6948): [388] BasicNetwork.performRequest: Unexpected response code 404 for https://android.clients.google.com/fdfe/
E/Finsky ( 6948): [1] LeanbackBrowseFragment.onErrorResponse: onErrorResponse -> Error retrieving information from server. [DF-DFERH-01]
I/qtaguid ( 6948): Failed write_ctrl(u 68) res=-1 errno=22
I/qtaguid ( 6948): Untagging socket 68 failed errno=-22
W/NetworkManagementSocketTagger( 6948): untagSocket(68) failed with errno -22
D/Finsky ( 6948): [1] MultiWayUpdateController.collateResponses: Change varies-by-account for com.gameloft.android.ANMP.GloftRAHM to true
D/Finsky ( 6948): [1] MultiWayUpdateController.collateResponses: Change varies-by-account for com.invictus.daytonarush to true
D/Finsky ( 6948): [1] MultiWayUpdateController.collateResponses: Change varies-by-account for com.google.android.googlequicksearchbox to true
D/Finsky ( 6948): [1] MultiWayUpdateController.collateResponses: Change auto-acquire tags for com.google.android.googlequicksearchbox from to d_AAAAAAADF8w=
D/TaskPersister( 525): removeObsoleteFile: deleting file=2820_task.xml

W/NetworkManagementSocketTagger( 6948): untagSocket(69) failed with errno -22
V/GLSActivity( 2017): AuthDelegateWrapperCreated with selected intent: Intent { cmp=com.google.android.gms/.auth.DefaultAuthDelegateService }
D/Finsky ( 6948): [1] AppActionAnalyzer.<init>: tunein.player is installed but certificate mistmatch
D/AudioFlinger( 184): Disable DS for device=0x400profile=0xffffffff
V/GLSActivity( 2017): AuthDelegateWrapperCreated with selected intent: Intent { cmp=com.google.android.gms/.auth.DefaultAuthDelegateService }
D/Finsky ( 6948): [1] AppActionAnalyzer.<init>: tunein.player is installed but certificate mistmatch
D/Finsky ( 6948): [1] AppActionAnalyzer.<init>: tunein.player is installed but certificate mistmatch
D/Finsky ( 6948): [1] AppActionAnalyzer.<init>: tunein.player is installed but certificate mistmatch
I/qtaguid ( 6948): Failed write_ctrl(u 69) res=-1 errno=22
I/qtaguid ( 6948): Untagging socket 69 failed errno=-22
W/NetworkManagementSocketTagger( 6948): untagSocket(69) failed with errno -22
V/GLSActivity( 2017): AuthDelegateWrapperCreated with selected intent: Intent { cmp=com.google.android.gms/.auth.DefaultAuthDelegateService }

W/NetworkManagementSocketTagger( 6948): untagSocket(68) failed with errno -22
D/AndroidRuntime( 6948): Shutting down VM
E/AndroidRuntime( 6948): FATAL EXCEPTION: main
E/AndroidRuntime( 6948): Process: com.android.vending, PID: 6948
E/AndroidRuntime( 6948): java.lang.IllegalStateException: Item clicked listener must be set before views are created
E/AndroidRuntime( 6948):	at android.support.v17.leanback.app.RowsSupportFragment.setOnItemViewClickedListener(RowsSupportFragment.java:154)
E/AndroidRuntime( 6948):	at com.google.android.finsky.fragments.LeanbackCategoryDisplayFragment.setViewFragment(LeanbackCategoryDisplayFragment.java:17348)
E/AndroidRuntime( 6948):	at com.google.android.finsky.fragments.LeanbackCategoryDisplayFragment.rebindAdapter(LeanbackCategoryDisplayFragment.java:472)
E/AndroidRuntime( 6948):	at com.google.android.finsky.fragments.LeanbackCategoryDisplayFragment.onDataChanged(LeanbackCategoryDisplayFragment.java:338)
E/AndroidRuntime( 6948):	at com.google.android.finsky.api.model.DfeModel.notifyDataSetChanged(DfeModel.java:104)
E/AndroidRuntime( 6948):	at com.google.android.finsky.api.model.PaginatedList.onResponse(PaginatedList.java:471)
E/AndroidRuntime( 6948):	at com.google.android.finsky.api.DfeRequest.deliverResponse(DfeRequest.java:20726)
E/AndroidRuntime( 6948):	at com.android.volley.ExecutorDelivery$ResponseDeliveryRunnable.run(ExecutorDelivery.java:99)
E/AndroidRuntime( 6948):	at android.os.Handler.handleCallback(Handler.java:739)
E/AndroidRuntime( 6948):	at android.os.Handler.dispatchMessage(Handler.java:95)
E/AndroidRuntime( 6948):	at android.os.Looper.loop(Looper.java:135)
E/AndroidRuntime( 6948):	at android.app.ActivityThread.main(ActivityThread.java:5462)
E/AndroidRuntime( 6948):	at java.lang.reflect.Method.invoke(Native Method)
E/AndroidRuntime( 6948):	at java.lang.reflect.Method.invoke(Method.java:372)
E/AndroidRuntime( 6948):	at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:964)
E/AndroidRuntime( 6948):	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:759)
E/AndroidRuntime( 6948):	at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:117)
I/AndroidRuntime( 6948): To Report FATAL to activityManagerService
I/ActivityManager( 525): handleApplicationCrash
V/GLSActivity( 2017): AuthDelegateWrapperCreated with selected intent: Intent { cmp=com.google.android.gms/.auth.DefaultAuthDelegateService }
I/ActivityManager( 525): addErrorToDropBox inserted hashcode=27b84745aae06d202918a82429f53cc99ed5047b for eventType crash.
W/ActivityManager( 525): Force finishing activity 1 com.android.vending/com.google.android.finsky.activities.TvMainActivity
I/AndroidRuntime( 6948): Finished reporting FATAL to activityManagerService
I/Process ( 6948): Sending signal. PID: 6948 SIG: 9
I/CrashDescriptorUtil( 525): addErrorToCommonLog Hash already present in file
W/InputDispatcher( 525): channel '18c8983e com.android.vending/com.google.android.finsky.activities.TvMainActivity (server)' ~ Consumer closed input channel or an error occurred. events=0x9
E/InputDispatcher( 525): channel '18c8983e com.android.vending/com.google.android.finsky.activities.TvMainActivity (server)' ~ Channel is unrecoverably broken and will be disposed!
I/WindowState( 525): WIN DEATH: Window{18c8983e u0 com.android.vending/com.google.android.finsky.activities.TvMainActivity}
W/InputDispatcher( 525): Attempted to unregister already unregistered input channel '18c8983e com.android.vending/com.google.android.finsky.activities.TvMainActivity (server)'
I/ActivityManager( 525): Process com.android.vending (pid 6948) has died